Official UK procurement notice
UKRI-6251 Cyber Security – Managed Service and Detection Response & Security Operations Centre service
Authority: UK Research and Innovation (Central government)
What is being bought
Published requirement descriptionUKRI-6251 Cyber Security – Managed Service and Detection Response & Security Operations Centre service. A Cyber Security provider to deliver collaborative SOC services, working with the existing STFC cyber security team.
CPV: Computer support and consultancy services · Security services · Security software development services
The lotProcurement structure
single lot · no lot value publishedPipeline intelligence · planning stage: how this market runs before the tender is published
How UK Research and Innovation buys Programming services of packaged software products (CPV 7221), and who usually turns up
UK Research and Innovation’s own published record, next to the published market for the same work. Frameworks and DPS are kept out: they attract a different number of bids. Whole-market view: Programming services of packaged software products (CPV 7221) →
How the contest usually goes
Winner shares use published awards; bid and price charts use contested lots.
i
How often small and medium firms win.
Share of awards where the winner’s size is known.
The counts under this question show how many awards have a known supplier size.
Small firms have won here. Neither number says whether you qualify; it describes who has been winning.
i
How often local firms win similar work.
Winners with a registered address in the delivery region, out of awards with a known address.
A local branch does not count if the registered address is elsewhere.
Most of this buyer’s recorded winners are registered outside the delivery region.
i
How long buyers here take to decide after bids close.
Middle value in days from the deadline to the first award notice, on competitions that published both dates.
Only decided tenders count, so slow ones still waiting are not in.
Half of these awards were announced within 30 days of the bid deadline.
i
How often work is awarded with no recorded rival.
Direct awards and tenders where every published lot count shows one bid.
The buyer’s share is a minimum: some awards have no bid count.
Thin markets produce this too; it is not proof of a tailored specification.
Direct awards or one recorded bid are common here. Check the route before spending time on a bid.
How many bids did past lots attract?
i
How many bids past lots received.
Each colour is a bid-count range. Only competed lots with a published count are included.
Past bids do not predict this tender.
1 bid25%
2–337%
4–621%
7+18%
How did awards compare with estimates?
i
Where winning prices landed against estimates.
Each colour shows awards below, close to or above the published estimate, one lot at a time.
Past prices are a guide, not a bid price.
Below estimate47%
Within ±2%40%
Above estimate14%
Assess each lot i
What past awards tell you about each lot.
See the forecast, this buyer’s earlier suppliers and firms with relevant wins.
No supplier is confirmed as a bidder.
i
What past awards tell you about each lot.
See the forecast, this buyer’s earlier suppliers and firms with relevant wins.
No supplier is confirmed as a bidder.
Open a lot for its forecast, this buyer’s previous supplier and possible competitors, from published award history, not a bid list
Lot #1CPV 7221Published estimate£1.3m
i
How many bids this lot may attract.
The forecast uses similar past competitions. The bar shows either that forecast or past bid counts; the line below says which.
Each lot shows its own forecast based on its own category; forecasts for different lots of the same notice are not comparative. The bar shows 80 past lots.
A forecast, not a list of bidders.
1 bid4%
2–334%
4–633%
7+30%
i
Where the award price may land.
The forecast uses similar awards and the buyer’s estimate. The band covers the middle half of likely prices.
No comparable awards for this lot yet.
A statistical guide from past awards, not a price to bid.
Who has supplied this buyer on similar work? i
Who has done similar work for this buyer.
Past contracts are matched by buyer, title and type of work.
A past supplier may not bid again.
i
Who has done similar work for this buyer.
Past contracts are matched by buyer, title and type of work.
A past supplier may not bid again.
| Supplier | This buyer’s earlier contract | Lot | Award value | Why listed |
|---|---|---|---|---|
| NORMCYBER LIMITEDLive contract | UKRI-5992 Detection and Response Serviceruns to May 2027 | — | £648k | Matched as the earlier contract |
Who could compete for this lot? i
Who could compete for this lot?
Firms with relevant past wins. On a framework, we show firms on that agreement.
None is confirmed as a bidder.
i
Who could compete for this lot?
Firms with relevant past wins. On a framework, we show firms on that agreement.
None is confirmed as a bidder.
Candidate suppliers for this notice have not been worked out yet, so this is not a verdict that nobody fits.
About this data
- Source. Official UK public procurement notices (Find a Tender), reused under the Open Government Licence v3.0. New notices arrive through the day; the figures are rebuilt nightly.
- Two views, kept apart. The authority’s own track record and the wider market for the same kind of work sit side by side and are never mixed. Where the local picture is too thin, a figure widens to a broader market and says which one it used.
- Forecasts are labelled. The price forecast and its range, possible competitors and the earlier-work matches are our estimates from past awards: not published facts, not win chances and not price advice. Official notices do not say who is bidding.
- Every figure shows what it rests on. Not every notice publishes a bid count, a value or a delivery region, so each figure carries the number of records behind it, and one built on few records is marked as such. The on a figure explains it; the counting rules are in the methodology. Spotted something wrong? Tell us.
What this replaces i
Who has done similar work for this buyer.
Past contracts are matched by buyer, title and type of work.
44% title match.
A past supplier may not bid again.
i
Who has done similar work for this buyer.
Past contracts are matched by buyer, title and type of work.
44% title match.
A past supplier may not bid again.
The prior contract this notice most likely re-tenders · matched by title and category (44% title match), the holder is not guaranteed to re-bid
UKRI-5992 Detection and Response Service — held by NORMCYBER LIMITED; the published contract ends 2 May 2027.
Procedure terms & legal framework
From the official record- Legal basis
- UKPGA · 2023/54 Procurement Act 2023
- Procurement category
- Services
- Notice status
- Planned procurement
- Procurement threshold
- Above threshold (FTS publication)
- Regulatory regime
- Standard
- Commercial structure
- Stand-alone contract (no framework)
- Competition type
- Competitive procedure
- GPA / WTO covered
- Unspecified in notice
- Recurring procurement
- Unspecified in notice
- First published
- 21 Aug 2026, 16:36 BST
- Last source update
- 16 Sept 2026, 12:54 BST
- Authority reference
UKRI-6251- FTS notice number
2026/S 000-087735- Latest notice
- Preliminary market engagement notice (UK2)
- Classification (CPV)
- Delivery area
- Official registry OCID
ocds-h6vhtk-06e9f0Find a Tender
How it was run
Official notice- Submission deadline
- —
Timeline
21 Aug 2026 → 1 Feb 2027 · 5 dates- Planning notice published62 days ago21 Aug 2026, 16:36 BST
- Market engagement40 days ago11 Sept 2026, 23:59 BST
Pre-Market Engagement – Cyber Security Managed Service Detection and Response
UK Research and Innovation (UKRI) and the Science and Technology Facilities Council (STFC) is undertaking a pre-market engagement to inform an upcoming procurement for a Managed Security Service Provider to deliver a cyber security managed detection and response / Security Operations Centre service.
The initial requirement is for the Science and Technology Facilities Council for an anticipated three-year contract, with an estimated value of approximately £1.25 million excluding VAT. The service is expected to provide 24/7 x 365 cyber security detection and response, with mobilisation commencing from February 2027 and the service operational by 1 May 2027.
STFC is also exploring the potential to scale the service to additional UKRI councils during the lifetime of the contract.
STFC is seeking feedback from the market to help inform the proposed service requirements, mobilisation and transition arrangements, scalability and commercial approach.
Engagement Activities
STFC intends to undertake: Request for Information (RFI): Suppliers are invited to complete the questionnaire.
To request a copy of the RFI, please email [email protected]
STFC may invite a limited number of suppliers to participate in structured one-to-one MS Teams meetings following review of the RFI responses. More information on this and the proposed route to market can be found in the RFI.
Participation in this pre-market engagement does not form part of any subsequent procurement evaluation and will not provide suppliers with an advantage in any future competition.
Amendment to Preliminary Market Engagement Notice
UKRI would like to clarify the proposed route to market for the subsequent procurement.
Subject to final approvals and confirmation of the procurement strategy, UKRI intends to utilise the Cyber Security Services 3 Dynamic Purchasing System (DPS), RM3764.3.
Suppliers who are not currently appointed to the DPS and wish to participate in any subsequent competition should apply to join the DPS via the Government Supplier Registration System.
Further information and the application process can be accessed here: supplierregistration.cabinetoffice.gov.uk/dps/RM3764.3 ↗
Suppliers should note that participation in this Pre-Market Engagement does not automatically result in an invitation to any subsequent competition. Supplier selection will be undertaken in accordance with the DPS requirements and applicable procurement procedures.
Reason for amendment: To clarify the proposed route to market and provide interested suppliers with information on how to join the intended DPS.
- Latest notice published36 days ago16 Sept 2026, 12:54 BST
- Tender notice expected20 days ago1 Oct 2026, 23:59 BST
- Today22 Oct 2026
- Contract startsin 102 days1 Feb 2027
Notice history
2 events · 2 releases on Find a Tender · since 21 Aug 2026- Preliminary market engagement notice published21 Aug 2026, 16:36 BSTUK2
- Preliminary market engagement notice published16 Sept 2026, 12:54 BSTUK2
Published amendments (1)
To clarify the proposed route to market for the subsequent procurement and provide interested suppliers with information on how to join the intended CCS Cyber Security Services 3 DPS (RM3764.3).
Commercial outcome & contract awards
Pipeline notice- Awards (0)
- No award published
- Contracts (0)
- No contract published
- Bid statistics
- No aggregate bid statistics published
Contracting authority & participating public bodies
Official documents & specifications (2)
Official links; attachments are not copiedNotices published for this procedure
- Preliminary market engagement notice Preliminary market engagement notice on Find a Tender
- Preliminary market engagement notice Preliminary market engagement notice on Find a Tender